You want the routine work off your plate. What stops most owners from handing it to an AI is a worry they rarely say out loud: your customer list, your invoices, your staff's hourly records, handed to a system that might keep them, learn from them, or pass them somewhere you never approved. So the AI question quietly becomes a privacy question, and it never gets answered.
An AI employee from Idle Work is built to answer that fear first. Every client's agent runs on its own machine, kept apart from every other client's, on hardware we own and operate in the United States, with the whole setup written out on our security page. You keep control: the agent starts by watching and drafting, anything that leaves your business gets turned on one at a time behind an approval gate you set, and you can export or delete your data at any time.
What you actually get
The top of the security page is a list of five controls, and the page says plainly that each one is a control you can ask us to evidence, not a row of logos. Here is that list as the page shows it, as a sample of what you can hold us to:
- Single-tenant isolation (in place). One machine per client, and client machines cannot reach each other's data.
- Encrypted in transit and at rest (in place).
- Zero-retention AI provider (in place). Everything you send to the AI provider and everything it sends back is never logged or used for training.
- PCI DSS Level 1 payments (in place). Card details go straight to Stripe, and we never see or store a card number.
- CASA AL1 (in progress). The assessment behind Google account access, reviewed by an authorized lab and renewed every year.
The page also answers the first question anyone asks: where does my data physically live? On hardware we own and operate in the United States, with a short named list of subprocessors, each doing one specific job, from the AI provider to the payments processor. The security questionnaire, the architecture diagram or the full policy: ask and we send it the same day.
Why waiting makes it worse
Data does not stay small. Every month of normal trading adds customers, quotes, invoices and employee records, and the pile that could leak grows with the business.
Because there is no safer place to hand the work to, people improvise. Someone on deadline pastes a customer list or an overdue statement into a free AI tool to get through the day. That is how private records usually leave a small business: quietly, one paste at a time.
Every extra tool picked up along the way also creates another copy of the same records, in inboxes, group chats and personal laptops. A year of that leaves data scattered in places you would have to hunt down one by one before you could honestly say it is locked down.
How you stay in control
Nothing happens that you did not allow. The page lays out the limits:
- Start narrow. A new agent watches, drafts and reports first. Actions that leave your business, like sending mail, posting, or writing to a connected system, are turned on one at a time, and each runs behind an approval gate you configure. Raise or lower the bar per agent at any time.
- Grant access yourself, narrowly. Every integration is connected by you through the provider's own sign-in screen, with the narrowest scope that does the job. Revoke it from the portal or from the provider and the agent loses that access immediately.
- Nothing trains on your data. Not ours, and not the AI provider's: what you send to the provider and what it sends back is never logged, kept, or used for training, and that is the provider's written policy, not our assumption.
- Export or delete on request. Ask for an export and we produce one. Ask for deletion and we destroy the machine, purge its backups, and confirm when it is done.
A checklist you can run this week
This part works with or without us:
- Write down where the sensitive records live: customer details, quotes and invoices, employee records, anything with bank details.
- Ask your team what they paste into free AI or free online tools to save time. Every answer is a copy of your data you do not control.
- Switch on multi-factor sign-in everywhere it will accept it, starting with email and the bank.
- List every app and account that has a route to your records, then revoke what nobody has used in three months.
- Read the data policy of any AI tool you already use. If it does not say plainly that your inputs are never kept or used for training, stop using it today.
What to do next
Close the easy leaks from the checklist first, because they take an afternoon and no new tools. When you are ready to hand the work over safely, Book an assessment: we come back with what we would automate first, and what we would leave alone. If you would rather try an agent first, every one starts with a 14 day trial, then $50 a month from day 15, and if you cancel before day 15 you are never charged.